MicrosoftDavid_Guyer Something else I wanted to point out, perhaps as you all think about Intune futures.
I find myself, more and more, relying on the telemetry in the defender endpoint screens (security.microsoft.com), endpoints, inventories as they present data in a way that is far easier to comprehend and take action on. For example, with the new driver feature, it's far easier to go look at the "Hardware &Firmware" inventory to see that my Intune policy for device firmware (BIOS) is working, including the trending over time. For example, this is far more helpful visually then the current reports:
In addition, the device page under 365 Defender (Assets/Devices) is again more actionable then the equivalent in Intune. For example, just knowing the logged in users over the last 30 days would be a helpful addition to the Intune device page, as would the additional application data e.g., vendor from those screens. I'd also vote for more inventory consistency between the two products, where the 365 defender inventory appears more complete than the one in Intune e.g., Intune doesn't show that the Adobe suite or Firefox is installed on our devices, but 365 defender does capture them, so clearly there is a difference in the detection tools.
Perhaps the big ask is to integrate the 365 defender data into Intune in those cases where a customer has both deployed. I'm a big fan of single-pane-of-glass views.
